From f74cc8f0aab03a6fe979cae4794a5e7a40d9933a Mon Sep 17 00:00:00 2001
From: Nicolas De Loof <nicolas.deloof@gmail.com>
Date: Thu, 13 Aug 2020 15:43:24 +0200
Subject: [PATCH] Allow user to customize Roles / ManagedPolicy

Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
---
 ecs/pkg/amazon/backend/cloudformation.go | 19 +++++++++++++++----
 ecs/pkg/amazon/backend/iam.go            |  2 +-
 ecs/pkg/compose/x.go                     |  2 ++
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/ecs/pkg/amazon/backend/cloudformation.go b/ecs/pkg/amazon/backend/cloudformation.go
index aa43dbe98..c6c033db4 100644
--- a/ecs/pkg/amazon/backend/cloudformation.go
+++ b/ecs/pkg/amazon/backend/cloudformation.go
@@ -440,15 +440,26 @@ func createTaskExecutionRole(service types.ServiceConfig, err error, definition
 			PolicyDocument: policy,
 			PolicyName:     fmt.Sprintf("%sGrantAccessToSecrets", service.Name),
 		})
+	}
 
+	if roles, ok := service.Extensions[compose.ExtensionRole]; ok {
+		rolePolicies = append(rolePolicies, iam.Role_Policy{
+			PolicyDocument: roles,
+		})
+	}
+	managedPolicies := []string{
+		ECSTaskExecutionPolicy,
+		ECRReadOnlyPolicy,
+	}
+	if v, ok := service.Extensions[compose.ExtensionManagedPolicies]; ok {
+		for _, s := range v.([]interface{}) {
+			managedPolicies = append(managedPolicies, s.(string))
+		}
 	}
 	template.Resources[taskExecutionRole] = &iam.Role{
 		AssumeRolePolicyDocument: assumeRolePolicyDocument,
 		Policies:                 rolePolicies,
-		ManagedPolicyArns: []string{
-			ECSTaskExecutionPolicy,
-			ECRReadOnlyPolicy,
-		},
+		ManagedPolicyArns:        managedPolicies,
 	}
 	return taskExecutionRole, nil
 }
diff --git a/ecs/pkg/amazon/backend/iam.go b/ecs/pkg/amazon/backend/iam.go
index 81a4fdb0f..4b282020e 100644
--- a/ecs/pkg/amazon/backend/iam.go
+++ b/ecs/pkg/amazon/backend/iam.go
@@ -22,7 +22,7 @@ var assumeRolePolicyDocument = PolicyDocument{
 	},
 }
 
-// could alternatively depend on https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/master/pkg/cloud/services/iam/types.go#L52
+// could alternatively depend on https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/master/cmd/clusterawsadm/api/iam/v1alpha1/types.go
 type PolicyDocument struct {
 	Version   string            `json:",omitempty"`
 	Statement []PolicyStatement `json:",omitempty"`
diff --git a/ecs/pkg/compose/x.go b/ecs/pkg/compose/x.go
index 63f2e30e7..3a4ffdb61 100644
--- a/ecs/pkg/compose/x.go
+++ b/ecs/pkg/compose/x.go
@@ -10,4 +10,6 @@ const (
 	ExtensionMinPercent      = "x-aws-min_percent"
 	ExtensionMaxPercent      = "x-aws-max_percent"
 	ExtensionRetention       = "x-aws-logs_retention"
+	ExtensionRole            = "x-aws-role"
+	ExtensionManagedPolicies = "x-aws-policies"
 )